Websites go dark after AI exposes major programming language security flaw

Read the original at Euronews ↗
Cite

Bligh, H. (2026, October 22). Websites go dark after AI exposes major programming language security flaw. Euronews. https://www.euronews.com/2026/10/22/websites-go-dark-after-ai-exposes-major-programming-language-security-flaw

Dated from the outlet's own feed. Check the original for its byline.

Euronews · collected 2026-10-22 · by Harry Bligh

Quick Summary

On Wednesday, numerous government agencies and companies worldwide shut down websites due to critical security flaws in PHP, a programming language used by approximately 70% of web sites globally. The flaws were discovered independently by Calif, funded by OpenAI's GPT-5.6 Sol model, and Wiz, a Google-owned cybersecurity company. Both vulnerabilities scored a severity rating of 9.2 out of 10, prompting immediate action to update or shut down systems, including actions taken by the Wikimedia Foundation, Amazon Threat Intelligence, and several European governments like France and Germany.
Written locally by qwen2.5:14b on 2026-10-22, using this article's own text rather than the other coverage of the same event (that is the story summary below).

AI analysis runs on qwen2.5:14b, locally

Story summary

Critical vulnerabilities in PHP, a widely-used programming language that powers around 70% of websites globally, prompted many sites to go dark on October 21, 2026, as operators raced to update their systems. European and British authorities recommended temporarily taking down affected sites due to fears hackers could exploit the flaws to take control of servers. Websites from various countries including Japan, Finland, and the Netherlands voluntarily went offline. In the UK, government bodies like the Office for Budget Responsibility (OBR) also took precautionary measures by disabling their websites. Developers released emergency patches on Wednesday afternoon after security firm Calif discovered one flaw in August with assistance from AI, and Google-owned Wiz independently found both vulnerabilities. The flaws carry a severity rating of 9.2 out of 10, indicating critical risk if not patched immediately.

Written for “Global PHP Security Flaw” on 2026-10-22, grounded in this article and the 14 other(s) covering the same event.
Why this leaning score
This article does not take a side on a contested political question, so it has no leaning score. That is an answer rather than a gap: a match report or a rescue can be warmly or critically written without being left or right, and scoring it anyway is how approval of a subject gets recorded as a political position.
No political leaning scored for article 98692 · logged 2026-10-22

Story

📰 Global PHP Security Flaw
Technology · 15 article(s) covering the same event. Compare every outlet's account →

Compared with similar articles

This article reads unscored and hedges 16% of its claims. Each row says how that neighbour differs.
Evening Standard · 0.86 cosine similarity
⚖️ leaning not scored 🔴 25% hedged 6 of 24 📰 publisher trust 65
“Both articles describe a single incident where AI discovered critical security flaws in PHP leading to websites being taken offline around the world on the same date.”
Toronto Star · 0.91 cosine similarity
⚖️ leaning not scored 🔴 33% hedged 1 of 3 📰 publisher trust 63
“Both articles report on the identical incident of critical vulnerabilities in PHP causing websites to go offline for security updates.”
The Straits Times · 0.90 cosine similarity
⚖️ leaning not scored 🔴 15% hedged 2 of 13 📰 publisher trust 68
“Both articles describe the identical incident of critical vulnerabilities in PHP causing widespread website outages on the same day.”
Al Jazeera · 0.88 cosine similarity
⚖️ leaning not scored 🔴 10% hedged 2 of 21 📰 publisher trust 60
“Both articles describe the identical incident of critical security flaws being discovered in PHP, prompting worldwide action to secure or shut down affected websites.”
New York Post · 0.86 cosine similarity
⚖️ leaning not scored 🔴 33% hedged 3 of 9 📰 publisher trust 66
“Both articles describe a single incident where websites were temporarily shut down due to newly disclosed vulnerabilities in PHP on the same day.”
NBC News
⚖️ leaning not scored 🔴 15% hedged 2 of 13 📰 publisher trust 95
“Both articles describe the same critical vulnerabilities in PHP leading to recommendations for websites to go offline or update systems immediately as of Wednesday morning.”
BBC News
⚖️ leaning not scored 🔴 16% hedged 4 of 25 📰 publisher trust 69
“Both articles describe the same incident where websites were taken down due to critical vulnerabilities in PHP, with updates released on Wednesday.”
The Straits Times
⚖️ leaning not scored 🔴 15% hedged 4 of 26 📰 publisher trust 68
“Both articles describe government websites going dark due to critical vulnerabilities in PHP discovered on the same day.”
CBC News
⚖️ leaning not scored 🔴 11% hedged 2 of 18 📰 publisher trust 74
“Both articles describe websites going offline on the same day due to critical vulnerabilities found in PHP, with urgent fixes released by developers.”
ABC News (AU)
⚖️ leaning not scored 🔴 19% hedged 5 of 27 📰 publisher trust 68
“Both articles describe the identical incident of critical security flaws being discovered in PHP, leading to websites going dark or limiting access as a result.”
How this article was measured signals, leaning charts, publisher record, byline, topics and claims

Signals How these are calculated →

Claims extracted
19
sentences that state something as happening or true
Uncertain
16%
3 of 19 hedged ("reportedly", "may", "according to")
Leaning
not political
takes no side on a contested political question
Publisher signals
60/100
Euronews's corrections and hedging, across everything collected from it. Not a measure of accuracy.
Outlets on this story
15
Technology
Same framing elsewhere
1
articles that frame the event the way this one does
Analyzed 2026-10-22 · how these are computed

How this is being covered How these are calculated →

Article leaning vs. publisher reliability
Source leaning vs. consistency

Publisher

Euronews · 966 article(s) · 1 correction(s) detected
Running correction rate · 1 correction(s)

Who wrote this

Harry Bligh
8 article(s) here · 1 carrying a prediction
🔮 Developers released emergency fixes on Wednesday, while cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they could be secured.
🔮 Previously, as the mayor of Greater Manchester, Andy Burnham had said Trump was not welcome in the city and that he would refuse to meet him.
🔮 The Mayor of Austin, Kirk Watson, has called for an independent probe involving local police, saying ICE should not investigate the incident by itself.
🔮 It is not yet clear what the ban will entail.
🔮 The Governor of South Cotabato, Reynaldo Tamayo, said the two students killed were a boy and a girl.
🔮 Experts have estimated it could take around three years to restore stocks of advanced missiles and defensive interceptors to pre-war levels.
Also by Harry Bligh
Nothing else under this byline is closely related to this article, so these are simply their most recent.
All 8 articles by Harry Bligh →

Topics

Calif Google OpenAI PHP Wiz

Subjects

Calif ORG · 2× OpenAI ORG · 2× Amazon Threat Intelligence ORG · 1× European NORP · 1× France GPE · 1× Google ORG · 1× Interior Ministry ORG · 1× The Wikimedia Foundation ORG · 1× Wikipedia ORG · 1× Wiz ORG · 1×

Narrative

Government agencies and companies around the world shut down websites Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet.
framing: assertive · carried by 1 article(s) · first seen 2026-10-22
🔮 Developers released emergency fixes on Wednesday, while cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they could be secured.

Claims (19 extracted, 3 hedged)

Government agencies and companies around the world shut down websites Wednesday after two critical flaws came to light involving PHP, a programming language that is the basis for a large share of the internet. asserted
that → shut → internet
Critical security flaws have been discovered in PHP, a widely used programming language that helps power around 70% of the world’s websites. asserted
that → discover → websites
Developers released emergency fixes on Wednesday, while cybersecurity authorities urged organisations to update affected systems immediately or take them offline until they could be secured. uncertain
they → release → them
The warning prompted governments, companies and major online services in several countries to temporarily shut down websites and other systems as a precaution. asserted
warning → prompt → precaution
The vulnerabilities were uncovered with the help of artificial intelligence. asserted
vulnerabilities → uncover → intelligence
Security firm Calif identified one of the flaws in August during an OpenAI-funded audit of PHP, while Google-owned cybersecurity company Wiz independently discovered and reported both vulnerabilities. asserted
Wiz → identify → vulnerabilities
OpenAI said its GPT-5.6 Sol model was used in the Calif research. asserted
model → say → research
The PHP security team rated both vulnerabilities 9.2 out of 10 for severity. asserted
team → rat → severity
Details were meant to remain confidential while developers prepared fixes, but information about the flaws emerged publicly before the planned release, intensifying the race to secure vulnerable systems. asserted
information → mean → systems
Security researchers initially reported little evidence of widespread exploitation before the vulnerabilities became public. asserted
vulnerabilities → report → exploitation
However, attempted attacks have since been detected, increasing concern that unpatched systems could be targeted. uncertain
systems → attempt → concern
Websites and services taken offline The Wikimedia Foundation, which operates Wikipedia, said it deliberately took a number of supporting services offline while security updates were installed and warned users that some disruption could occur. uncertain
disruption → take → users
Amazon Threat Intelligence also detected attempts to exploit the vulnerabilities, including activity before their public disclosure. asserted
Intelligence → detect → disclosure
Security researchers have since reported attempts to target vulnerable systems in the wild. asserted
researchers → report → wild
Several European governments have also taken precautionary action. asserted
governments → take → action
France’s Interior Ministry temporarily took prefecture websites offline while updates were applied, while Germany’s federal IT provider ITZBund shut down several government websites. asserted
provider → take → websites
German officials said the move was precautionary and that no security incidents had been identified. asserted
incidents → say → ?
Government and public-service websites were also taken offline in countries including the Netherlands and Finland, as authorities worked to secure their systems. asserted
authorities → take → systems
In the UK, the National Cyber Security Centre urged organisations running PHP to identify vulnerable systems, monitor them for suspicious activity and install security updates as soon as possible. asserted
Centre → urge → updates
💬Give feedback
🕘History 🎫Support